Prior art engine failure monitors typically indicate a failure in response to a selected parameter exceeding a limit, and therefore excessive delays from one-half to 5 seconds may be incurred before the detection of an engine failure. Commonly owned U.S. Pat. No. 4,817,046 to Rice et al. (Rice '046 patent) describes various subroutine logic for detecting an engine failure in a multi-engine aircraft. The Rice engine failure monitor represents a significant improvement over prior art systems because it provides reliable and nearly instantaneous detection of an engine failure.
When a failure of one of the aircraft engines is detected, a visual and/or aural warning is provided to the pilot to indicate that an engine has failed. Additionally, the gain of the power turbine speed governor is increased to provide additional required response. Finally, the electronic engine control power limits of the operating engine, e.g., engine or main gear box (MGB) torque limit, NG limit, and T5 limit, are increased to One Engine Inoperative (OEI) limits, i.e., single engine limits, to ensure that the operating engine has power available for a safe landing.
Engines often fail partially or intermittently, and settle out at some part power condition. Since the engine has not completely failed, it is often left on line either indefinitely or during trouble-shooting of the problem. A partial engine failure could be caused by foreign object damage (FOD), oil starvation, internal component failure, auxiliary or bleed air system failures, etc. These failures often result in sudden and significant power loss, and therefore the engine failure monitor described in the Rice '046 patent may treat a partial or intermittent engine failure as a total engine failure. Once the engine settles out at a reduced power level, current engine failure monitor logic terminates the engine failure warning, restores the governing gains for dual engine operation and reduces the power limits on the remaining normally operating engine(s) from the OEI limits back to dual or multi-engine operating limits.
There are a number of problems which may occur when an engine failure monitor fails to detect a partial engine failure. First, the engine governing gains are set for single engine operation when in fact both engines are on line (i.e., when a partial engine failure is indicated as a total engine failure). This situation immediately prompts a low frequency, high amplitude oscillation in the aircraft drive train because the system gain is too high. Secondly, when the engine settles out at a new lower power level, the operating limits for the normally operating engine are lowered from their emergency OEI value to their normal value, thereby reducing the total power available in this emergency situation.
It has also been found that prior art engine failure monitors may not detect an engine driveshaft failure in sufficient time to allow the engine to be shut down prior to self-destructive engine over speed.